SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Change Healthcare Estimates 100 Million Affected by February Breach
In a recent updated filing with US Department of Health and Human Services Office for Civil Rights (HHS OCR), Change Healthcare now estimates the number of individuals affected by the February 2024 breach to be 100 million. HHS OCR has published an updated FAQ about the breach. The new statistics make the Change Healthcare incident the largest healthcare breach on record.
Editor's Notes
- Slide 1 of 3
Back in April, Change Healthcare publicly admitted that 'the impacted data could cover a substantial proportion of people in America.' That statement and 'largest healthcare breach on record' should be required to be shown prominently on all their marketing material, kinda like the warnings on cigarette packaging.
- Slide 2 of 3
A breach of this scope and size deserves to be a case study in lessons learned. I hope in 2025 our friends at the Cybersecurity Review Board (CSRB) can publish a report detailing findings and key takeaways, just as they did earlier this year for the Microsoft breach in 2023.
- Slide 3 of 3
Oddly as breach notifications continue to arrive, I've seen notifications for my deceased neighbors. My point is breach notifications are taking a long time and you need to get proactive and setup your own identity restoration/credit monitoring. Lock your credit. Don't wait to find out you've got a problem.
Slide 1 of 0- Slide 1 of 3
Hospitals are Using Untrustworthy AI Transcription Tools
When OpenAI introduced their transcription tool, Whisper, in 2022, they claimed it 'approache[d] human level robustness and accuracy.' However, the tool in fact is prone to hallucinations and a ChatGPT-generated description of Whisper recommends against the tool being used in 'high-risk domains.' Despite the warning, healthcare organizations are using Whisper; software engineers, developers, and researchers found high levels of inaccurate chunks of text and even entirely false sentences in Whisper-generated AI transcriptions they examined.
Editor's Notes
- Slide 1 of 3
AI literally has decades of over-hype but has gotten Bitcoin-like levels of promotion in the past few years. All too often, using an AI-generated document is like eating a meal you created from room service trays left outside of hotel room doors on your way from the elevator to your room.
- Slide 2 of 3
Troubling, as this deals with patient healthcare records. Is it simply that in the rush to get to market the tool had insufficient data from which to train, or are there underlying assumptions made by the model that are incorrect? Whatever the cause, a general warning not to use in high-risk domains is insufficient.
- Slide 3 of 3
We should all be investigating AI capabilities, but not without careful review of the results. Remember this is still new technology and we are still learning not just how to use it but also where the information provided is stored, leveraged, and shared.
Slide 1 of 0- Slide 1 of 3
Health Aging Poll: Older Adults Wouldn't Trust AI-Generated Health Information
According to the University of Michigan National Poll on Health Aging, nearly three-quarters of adults over the age of 50 say they would not trust AI-generated health information. Overall, 20 percent of those responding said they had 'little or no confidence' in their ability to identify health misinformation.
Editor's Notes
- Slide 1 of 2
As an old fart, I have trouble with chat/audio assistants trying to assist me with my call. While these have improved the experience, and are designed to allow services to scale, and numbers show they have a lot of success, they are not yet a complete human replacement, particularly for those of us who grew up with non-automated response. If you're providing automated response services, make sure there is an easy option to request a human.
- Slide 2 of 2
It is good to see this level of skepticism around AI tools. Hopefully people will continue to rely on medical experts rather than Dr. AI or indeed Dr. Google.
Slide 1 of 0- Slide 1 of 2
The Rest of the Week's News
US Copyright Office Grants Partial DMCA Exemption for Retail Food Prep Equipment Repair
The US Copyright Office has granted a partial Digital Millennium Copyright Act (DMCA) exemption 'allowing for repair of retail-level food preparation equipment.' The exemption was requested by Public Knowledge, a consumer advocacy group, along with iFixit. The original, broader request sought 'to expand the repair exemption for consumer electronic devices to include commercial industrial equipment such as automated building management systems and industrial equipment (i.e. soft serve ice cream machines and other industrial kitchen equipment).' The Copyright Office considered a total of seven proposed classes for exemption and granted all but one: a request regarding the preservation of video games.
Editor's Notes
- Slide 1 of 3
The "right to repair" movement has significant implications for device security. As more and more "smart devices" are reaching end of support, or vendors go out of business, it becomes more and more important for owners to have the ability to apply fixes to software and hardware. While it may sound benign to be able to fix an ice cream machine, the implications could be far reaching.
- Slide 2 of 3
A win for 'consumer right to repair' advocates and McFlurry lovers around the world. The US would be well served modeling federal law off the NY State Digital Fair Repair Act. This State law addresses many of the concerns of manufacturers (i.e., protection of trade secrets, liability, etc.).
- Slide 3 of 3
With increased 'right to repair,' the burden passes to the consumer to ensure the repair is done with genuine components by trained technicians. Consider the supply chain risk when screening alternate repair services.
Slide 1 of 0- Slide 1 of 3
Russian Prison Sentences for Members of REvil Ransomware Group
Russian courts sentenced members of the REvil gang to prison terms for hacking and money laundering. The group is best known for 2021 attacks on meat-packing company JBS and IT services firm Kaseya. Members of the REvil team were arrested in 2022 with cooperation from US law enforcement.
Editor's Notes
With Russia's invasion of Ukraine in 2022, the US Department of Justice stopped cooperating with Russian authorities. Many of us thought that would be the end of the case against REvil, especially where hacking companies in foreign countries is not illegal in Russia. While several gang members were released, you've got to hand it to Russian authorities for following through to prison sentences on some of the key players.
Arcadyan Routers Vulnerable Through Wi-Fi Test Suite
The Software Engineering Institute's (SEI) Computer Emergency Response Team Coordination Center (CERT/CC) following up on disclosure by independent researcher "fj016" and SSD Secure Disclosure, has released an advisory describing a command injection vulnerability in the Wi-Fi Alliance's Test Suite tool. Using "specially crafted packets," an attacker could gain root privileges and execute code, posing particular risk to any "commercial router deployments" where the Wi-Fi Test Suite is not meant to be used. The vulnerable code is found on the Arcadyan FMIMG51AX000J model device. There is no patch from the manufacturer; CERT/CC recommends the Wi-Fi Test Suite be updated to at least version 9.0 or removed entirely.
Editor's Notes
This issue may affect other brands as well. The vulnerability was introduced by a test suite used by the Wi-Fi Alliance to verify compliance with Wi-Fi standards. Arcadyan did ship their devices leaving the test suite enabled. Others may have made the same mistake.
S3 Bucket Vulnerability in AWS Cloud Development Kit
Amazon Web Services' (AWS) Cloud Development Kit (CDK) has been vulnerable to S3 bucket "namesquatting," according to researchers at Aqua, which could lead to many security issues including "full account takeover." Aqua's research was published on October 24, 2024 and details their communication with AWS after reporting the flaw in June, 2024. An S3 staging bucket is created as part of the CDK bootstrapping process, and named using an easily predictable and exploitable naming system, which creates a vulnerability: "Criminals could predict AWS S3 bucket names, pre-load malicious code into a bucket, and then sit back and wait for the target org to execute it unwittingly. Once that happened, the attackers could steal data, or even take over a user's account without them knowing." Aqua notes "there's no way to know if the vulnerability, which doesn't have an associated CVE number, has been exploited in the wild." Amazon has patched the issue and notified customers, and Aqua suggests updating and re-running the boostrap command, or applying an "IAM policy condition ... similar to the AWS patch."
Editor's Notes
I guess the analogy here is if you are going to use dishes directly from the dishwasher, make sure you run the dishwasher first.
Operation Magnus: International Effort Results in Infostealer Malware-as-a-Service Disruption
The Dutch National Police (Politie) say they have obtained 'full access' to servers used by the Redline and Meta infostealers, both of which operate as malware-as-a-service. Operation Magnus, which involved law enforcement agencies from the US, the UK, Portugal, Australia, and EuroJust (the European Union Agency for Criminal Justice Cooperation), 'gained access to the Redline and Meta source code, including the license servers, REST API servers, panels, stealers, and Telegram bots.' The operation also turned up information that could be helpful in identifying people who used the malware.
Editor's Notes
A success is a success. That said, these sorts of tools are easy to replicate. Defenders are still best served by updating their software as patches become available, using a secure configuration, and actively monitoring their enterprise for compromise.